pf: test set-tos
Introduce tests for the set-tos feature of pf. Teach pft_ping.py to send and verify ToS flags.
This commit is contained in:
parent
eeec68eae7
commit
67f4baf8b0
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=324662
@ -5,7 +5,8 @@ PACKAGE= tests
|
||||
TESTSDIR= ${TESTSBASE}/sys/netpfil/pf
|
||||
|
||||
ATF_TESTS_SH+= pass_block \
|
||||
forward
|
||||
forward \
|
||||
set_tos
|
||||
|
||||
${PACKAGE}FILES+= utils.subr \
|
||||
pft_ping.py
|
||||
|
@ -18,7 +18,7 @@ def __init__(self, recvif):
|
||||
def run(self):
|
||||
self.packets = sp.sniff(iface=self._recvif, timeout=3)
|
||||
|
||||
def check_ping_request(packet, dst_ip):
|
||||
def check_ping_request(packet, dst_ip, args):
|
||||
"""
|
||||
Verify that the packet matches what we'd have sent
|
||||
"""
|
||||
@ -40,13 +40,27 @@ def check_ping_request(packet, dst_ip):
|
||||
if raw.load != str(PAYLOAD_MAGIC):
|
||||
return False
|
||||
|
||||
# Wait to check expectations until we've established this is the packet we
|
||||
# sent.
|
||||
if args.expect_tos:
|
||||
if ip.tos != int(args.expect_tos[0]):
|
||||
print "Unexpected ToS value %d, expected %s" \
|
||||
% (ip.tos, args.expect_tos[0])
|
||||
return False
|
||||
|
||||
|
||||
return True
|
||||
|
||||
def ping(send_if, dst_ip):
|
||||
req = sp.Ether() \
|
||||
/ sp.IP(dst=dst_ip) \
|
||||
/ sp.ICMP(type='echo-request') \
|
||||
/ sp.Raw(PAYLOAD_MAGIC)
|
||||
def ping(send_if, dst_ip, args):
|
||||
ether = sp.Ether()
|
||||
ip = sp.IP(dst=dst_ip)
|
||||
icmp = sp.ICMP(type='echo-request')
|
||||
raw = sp.Raw(PAYLOAD_MAGIC)
|
||||
|
||||
if args.send_tos:
|
||||
ip.tos = int(args.send_tos[0])
|
||||
|
||||
req = ether / ip / icmp / raw
|
||||
sp.sendp(req, iface=send_if, verbose=False)
|
||||
|
||||
def main():
|
||||
@ -61,19 +75,27 @@ def main():
|
||||
required=True,
|
||||
help='The destination IP address for the ICMP echo request')
|
||||
|
||||
# Packet settings
|
||||
parser.add_argument('--send-tos', nargs=1,
|
||||
help='Set the ToS value for the transmitted packet')
|
||||
|
||||
# Expectations
|
||||
parser.add_argument('--expect-tos', nargs=1,
|
||||
help='The expected ToS value in the received packet')
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
sniffer = None
|
||||
if not args.recvif is None:
|
||||
sniffer = Sniffer(args.recvif[0])
|
||||
|
||||
ping(args.sendif[0], args.to[0])
|
||||
ping(args.sendif[0], args.to[0], args)
|
||||
|
||||
if sniffer:
|
||||
sniffer.join()
|
||||
|
||||
for packet in sniffer.packets:
|
||||
if check_ping_request(packet, args.to[0]):
|
||||
if check_ping_request(packet, args.to[0], args):
|
||||
sys.exit(0)
|
||||
|
||||
# We did not get the packet we expected
|
||||
|
92
tests/sys/netpfil/pf/set_tos.sh
Executable file
92
tests/sys/netpfil/pf/set_tos.sh
Executable file
@ -0,0 +1,92 @@
|
||||
# $FreeBSD$
|
||||
|
||||
. $(atf_get_srcdir)/utils.subr
|
||||
|
||||
atf_test_case "v4" "cleanup"
|
||||
v4_head()
|
||||
{
|
||||
atf_set descr 'set-tos test'
|
||||
atf_set require.user root
|
||||
|
||||
# We need scapy to be installed for out test scripts to work
|
||||
atf_set require.progs scapy
|
||||
}
|
||||
|
||||
v4_body()
|
||||
{
|
||||
pft_init
|
||||
|
||||
epair_send=$(pft_mkepair)
|
||||
ifconfig ${epair_send}a 192.0.2.1/24 up
|
||||
|
||||
epair_recv=$(pft_mkepair)
|
||||
ifconfig ${epair_recv}a up
|
||||
|
||||
pft_mkjail alcatraz ${epair_send}b ${epair_recv}b
|
||||
jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
|
||||
jexec alcatraz ifconfig ${epair_recv}b 198.51.100.2/24 up
|
||||
jexec alcatraz sysctl net.inet.ip.forwarding=1
|
||||
jexec alcatraz arp -s 198.51.100.3 00:01:02:03:04:05
|
||||
route add -net 198.51.100.0/24 192.0.2.2
|
||||
|
||||
# No change is done if not requested
|
||||
printf "scrub out proto icmp\n" | jexec alcatraz pfctl -ef -
|
||||
atf_check -s exit:1 -o ignore $(atf_get_srcdir)/pft_ping.py \
|
||||
--sendif ${epair_send}a \
|
||||
--to 198.51.100.3 \
|
||||
--recvif ${epair_recv}a \
|
||||
--expect-tos 42
|
||||
|
||||
# The requested ToS is set
|
||||
printf "scrub out proto icmp set-tos 42\n" | jexec alcatraz pfctl -f -
|
||||
atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
|
||||
--sendif ${epair_send}a \
|
||||
--to 198.51.100.3 \
|
||||
--recvif ${epair_recv}a \
|
||||
--expect-tos 42
|
||||
|
||||
# ToS is not changed if the scrub rule does not match
|
||||
printf "scrub out proto tcp set-tos 42\n" | jexec alcatraz pfctl -f -
|
||||
atf_check -s exit:1 -o ignore $(atf_get_srcdir)/pft_ping.py \
|
||||
--sendif ${epair_send}a \
|
||||
--to 198.51.100.3 \
|
||||
--recvif ${epair_recv}a \
|
||||
--expect-tos 42
|
||||
|
||||
# Multiple scrub rules match as expected
|
||||
printf "scrub out proto tcp set-tos 13\nscrub out proto icmp set-tos 14\n" \
|
||||
| jexec alcatraz pfctl -f -
|
||||
atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
|
||||
--sendif ${epair_send}a \
|
||||
--to 198.51.100.3 \
|
||||
--recvif ${epair_recv}a \
|
||||
--expect-tos 14
|
||||
|
||||
# And this works even if the packet already has ToS values set
|
||||
atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
|
||||
--sendif ${epair_send}a \
|
||||
--to 198.51.100.3 \
|
||||
--recvif ${epair_recv}a \
|
||||
--send-tos 42 \
|
||||
--expect-tos 14
|
||||
|
||||
# ToS values are unmolested if the packets do not match a scrub rule
|
||||
printf "scrub out proto tcp set-tos 13\n" \
|
||||
| jexec alcatraz pfctl -f -
|
||||
atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
|
||||
--sendif ${epair_send}a \
|
||||
--to 198.51.100.3 \
|
||||
--recvif ${epair_recv}a \
|
||||
--send-tos 42 \
|
||||
--expect-tos 42
|
||||
}
|
||||
|
||||
v4_cleanup()
|
||||
{
|
||||
pft_cleanup
|
||||
}
|
||||
|
||||
atf_init_test_cases()
|
||||
{
|
||||
atf_add_test_case "v4"
|
||||
}
|
Loading…
Reference in New Issue
Block a user